In October 2026, attackers changed temperature and defrost settings on internet-exposed refrigeration controllers at more than 700 French supermarkets, causing food losses, according to Forescout and the French national CERT. Any organisation with building or process controllers reachable from the internet should remove that exposure now, restore remote maintenance through a secure gateway, and check configurations for unauthorised changes.
The incident did not need malware or a sophisticated exploit chain. It used ordinary supervisory functions on devices that were reachable from the internet, which is why the lessons apply far beyond food retail.
What happened
On 12 October 2026, CERT-FR, France's national computer emergency response team, issued alert CERTFR-2026-ALE-012 about compromises of remote controllers for refrigeration installations. It said it was aware of numerous compromises affecting Copeland and Dixell XWEB units and Danfoss AK-SC and AK-SM series controllers. The alert was updated on 13 October to add further targeted equipment and on 16 October with revised recommendations, and it warned that attack campaigns were likely still ongoing. Belgium's Centre for Cybersecurity also issued a warning about the French incidents.
On 22 October, Forescout's Vedere Labs published research stating that the incidents affected refrigeration management systems at more than 700 supermarkets. According to Forescout, public reporting described malicious changes to temperature and defrost controls that caused food losses, made through rapid, successive configuration changes that the researchers consider suggestive of automation. Forescout stresses that the initial access method, any vulnerabilities exploited and the people responsible have not been confirmed.
Forescout also measured exposure worldwide. Using internet search data, it found 12,976 exposed service observations across ten refrigeration product groups, on 6,017 public IP addresses in 99 countries and territories. For one controller family, it reported that around 80% of exposed observations ran firmware older than the release that fixes two known vulnerabilities, although it notes that this does not show those flaws were used in France. It also reported that some manufacturer documentation describes port forwarding and public IP addresses as ways to enable remote access, so internet exposure was sometimes a supported configuration rather than an accident.
Forescout places the incidents alongside more than 20 claimed hacktivist attacks on refrigeration systems it has tracked since January 2026, mostly against food and agricultural sites in Europe.
Why it matters for OT
Refrigeration controllers are operational technology. They read sensors, run control loops and drive physical equipment, and a wrong setpoint has a physical consequence: spoiled food, lost medicines or, in industrial settings, damaged product and process upsets. Forescout notes that similar cooling systems are used in hospitals and agricultural facilities.
The pattern is familiar from earlier attacks on water utilities and other critical services. A controller or HMI is placed on a public IP address, or behind a port forward, so that a contractor can maintain it remotely. Credentials are shared between sites and rarely changed. Firmware falls behind because nobody owns the device's security, and end-of-life units stay in service. When an attacker finds the interface, they do not need to break anything. They simply log in and use the controls the way an engineer would.
This is why "it's only a building system" is a risky assumption. Many industrial sites run HVAC, cold storage, clean rooms and utility systems that are managed by third parties, sit outside the main OT security programme and are missing from the asset inventory.
Who should act
- Food retail, cold chain, logistics and agricultural operators using remotely managed refrigeration.
- Hospitals, pharmaceutical and laboratory sites that depend on controlled temperatures.
- Manufacturers and process operators with contractor-managed HVAC, chillers or cold storage.
- Refrigeration and building services contractors who manage fleets of controllers on behalf of customers.
In the EU, NIS2 lists food businesses engaged in wholesale distribution and industrial production and processing among its covered sectors, and hospitals are also in scope; its risk management measures include supply chain security and access control. Check which obligations apply to your organisation rather than assuming.
What to do now
- Find what is exposed. List every controller, HMI and gateway that is reachable from the internet, including through port forwarding, NAT rules or a contractor's router. Check your own public IP ranges, not just your asset register.
- Remove direct internet access. Follow CERT-FR's advice: take management interfaces off public IP addresses, and restore remote access only through a VPN or protected remote access gateway. Treat source IP filtering for contractors as a temporary measure only.
- Check configurations for tampering. Review setpoints, defrost schedules, alarm settings and user accounts against known good values. CERT-FR advises reconfiguring compromised equipment before returning it to service, and warns that a factory reset alone leaves the device vulnerable.
- Fix credentials and access. Change default and shared passwords, give contractors named accounts with multi-factor authentication where the access path supports it, and log every remote session.
- Update or replace. Apply vendor hardening and firmware updates, and plan replacement for end-of-life controllers that no longer receive security fixes.
- Monitor for unusual changes. Alert on setpoint or schedule changes outside maintenance windows, bursts of rapid changes and logins at unusual times, and link them to approved remote sessions.
- Bring contractor-managed systems into scope. Add building, cooling and utility controllers to your OT asset inventory and risk assessment, and set security requirements in maintenance contracts.
How OTVista helps
OTVista's asset visibility and remote access modules, currently in early access, are designed to record which devices exist, who can reach them and through which path, and to track the remediation that follows. Our independent practitioners support secure remote access for contractors and the handling of legacy and end-of-life systems, and our earlier guide sets out a 2026 baseline for vendor remote access. For a quick view of where you stand, try the free OT Security Quick Check.
Sources: CERT-FR, CERTFR-2026-ALE-012 alert on remote controllers for refrigeration installations; Forescout Vedere Labs, Cold chain, open control: exposed refrigeration systems reveal global risk; Belgian Centre for Cybersecurity, warning on incidents in France targeting refrigeration remote controllers; Viakoo via Security Boulevard, Daily OT Security News: October 29, 2026.
Topics: refrigeration controller attack, internet-exposed OT devices, CERT-FR refrigeration alert, contractor remote access OT, building management system security, OT asset visibility